MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Threat unknown


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5
SHA3-384 hash: c1814dc9aac68c82cb56faf3264b28dedb1d23c8a22331cf44aae472a5c9883800ef2fa10a01f69a5da7fb1bc7458467
SHA1 hash: ef9ad297e92bae70b74a474ccd4ada2fbbe063bb
MD5 hash: f1372dd8724ed053ab72e305a9ff6165
humanhash: two-pizza-helium-king
File name:f1372dd8724ed053ab72e305a9ff6165.exe
Download: download sample
File size:176'640 bytes
First seen:2022-09-21 06:14:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'462 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 1536:zO6c9URWzKr7PhuuUpV7+5JTiy95+uUCQahsf5mZIWiwwr7QXsouW2ASDDA6rRf3:z1pWaxa7Dy95wS2cjxnqvXt/SSaSP
Threatray 533 similar samples on MalwareBazaar
TLSH T11C049E1BAB544B33C52B2BB985E747753230CC819F8B5F06A6E46D397ECA3C27D09188
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
File icon (PE):PE icon
dhash icon 3c696de440808480 (3 x CoinMiner, 2 x PureCrypter, 2 x AsyncRAT)
Reporter abuse_ch
Tags:exe

Intelligence

File Origin
# of uploads :
1
# of downloads :
213
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
f1372dd8724ed053ab72e305a9ff6165.exe
Verdict:
Malicious activity
Analysis date:
2022-09-21 06:21:56 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/8e621a9b-565f-463e-89fb-48a0fc427584

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/311955/
Detection(s):
SecuriteInfo.com.Trojan.DownLoader45.18858.20598.19892.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Sending an HTTP GET request
Sending a custom TCP request
Launching a process
Creating a process with a hidden window
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
obfuscated packed
Link:
https://www.filescan.io/uploads/632aac7b36ba812561a676b8/reports/e3c318c9-f683-402c-829e-968a7700a4b9/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Verdict:
Unknown
Link:
https://analyze.intezer.com/analyses/7ed2e687-6601-4a15-89b6-f97dc1f61110
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1074334
Signature
.NET source code contains potential unpacker
Antivirus detection for URL or domain
Encrypted powershell cmdline option found
Machine Learning detection for sample
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Yara detected Costura Assembly Loader
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 706881 Sample: jeaKQdsIHe.exe Startdate: 21/09/2022 Architecture: WINDOWS Score: 92 21 Snort IDS alert for network traffic 2->21 23 Multi AV Scanner detection for domain / URL 2->23 25 Antivirus detection for URL or domain 2->25 27 5 other signatures 2->27 7 jeaKQdsIHe.exe 15 3 2->7         started        process3 dnsIp4 19 194.38.23.170, 49699, 80 PRAID-ASRU Ukraine 7->19 29 Encrypted powershell cmdline option found 7->29 11 powershell.exe 14 7->11         started        13 powershell.exe 5 7->13         started        signatures5 process6 process7 15 conhost.exe 11->15         started        17 conhost.exe 13->17         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5/
Threat name:
Win32.Trojan.Tiggre
Create hunting rule
Status:
Malicious
First seen:
2022-09-20 18:34:27 UTC
File Type:
PE (.Net Exe)
Extracted files:
22
AV detection:
20 of 25 (80.00%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=on3pvrlrr4fcvqc6e6ptknkzz4qmqbdhl2ilhkvbjstu4fcvqk2q._file
Verdict:
malicious
Similar samples:
14ae647473cbf4def9becdbbb1f007fd8c96c63be5c88014415ab13e6467168f
151fb5746b08b95408b92e08f4bbeac8c4a1a3fc3ad6f43d237357f10476b33f
21bf3627b1e2a400d46ed681b6791b43b13a3f62615b74c3bdaeef402b11bf81
3be69750b64f87e18bcd6d779fbc9511f17e57b8c7738d9374e262fb377ff56a
643dca310ffa930db9dca8d6690c841d0ec0ab75913646756ebeb1bf2de82584
6897412732ce8f38317aefff9c2bb19b15a91caccb0922c53fe29c36474de665
88b00afd2b4f33893e8ca2dfb3a40cfa15d990d731cb1b15617a8f606b5672d0
8feeb31be2e79fc5c6ddd489dcbfe708c8890f107e32c788ec1b7842feead9d4
fec981d9e6f439dd72ab681e144d5da1302b20bcf45ca98ee15bf029eab135bd
+ 523 additional samples on MalwareBazaar
Result
Malware family:
n/a
Score:
  7/10
Tags:
n/a
Link:
https://tria.ge/reports/220921-gzxkfabacp/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Checks computer location settings
Verdict:
Malicious
Tags:
n/a
YARA:
n/a
Link:
https://app.threat.zone/submission/307b1d3f-f6e4-4f04-b3b9-24a0910b3f05
Unpacked files
SH256 hash:
7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5
MD5 hash:
f1372dd8724ed053ab72e305a9ff6165
SHA1 hash:
ef9ad297e92bae70b74a474ccd4ada2fbbe063bb
Link:
https://www.unpac.me/results/80d50cf7-6acc-49b8-b38d-cc5b233e31ab/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/7376fac5718f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.35
Link:
https://yomi.yoroi.company/submissions/7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Executable exe 7376fac5718f0a2ac05e279f353559cf20c804675e90b3aaa14ca74e145582b5

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/311955/
  
URLhaus
https://urlhaus.abuse.ch/url/2306837/
  
Delivery method
Distributed via web download

Comments